8 exchanges supportedSpot onlyNo leverageResponsible by Design11-layer analysis engineAES-256-GCM encrypted keys24/7 autonomous tradingFree 3-month trial

Public Index

Compliance Registers

Four registers sit at the centre of QARI's compliance posture. Each is actively version-controlled, reviewed every release, and available on request. This page is the public index.

RoPA

Data Protection Register

The single source of truth for every processing activity that touches personal data. Built to GDPR Article 30 (Records of Processing Activities). Required reading for any privacy review.

What it covers

  • Each category of personal data QARI processes (identity, trading configuration, payment, support interactions).
  • The lawful basis for every processing activity (contract, legitimate interest, consent, legal obligation).
  • Recipients and sub-processors. International transfer mechanisms.
  • Retention periods. Security controls. Data-subject rights surface.
Version
2.2
Last updated
2026-04-22
Review cadence
Reviewed every release, at minimum every 6 months.
Scope
All QARI production surfaces: scanner, execution, dashboard, landing, admin.
Owner
Clavon Solutions sp. z o.o. (Operator).
Request current copy

DPIA

Data Protection Impact Assessment

A structured analysis of the risks QARI's processing poses to data subjects, and the controls that bring residual risk to an acceptable level. Produced under GDPR Article 35 for processing that could result in a high risk to rights and freedoms.

What it covers

  • Necessity and proportionality of each processing activity.
  • Risk register: likelihood, severity, and controls for each identified risk to users.
  • Data-subject rights in practice: how each right is actionable in the product.
  • Release-by-release delta: does the new release change the residual risk profile?
Version
2.2
Last updated
2026-04-22
Review cadence
Re-assessed at every major release, at minimum every 6 months.
Scope
All processing QARI performs as controller.
Owner
Clavon Solutions sp. z o.o., acting DPO.
Request current copy

Processors

Processor Register

The list of every sub-processor with access to QARI-held personal data, the contractual basis for the relationship, and the international transfer mechanism where applicable. Required under GDPR Article 28.

What it covers

  • Every processor: Supabase, DigitalOcean, Cloudflare, Resend, Vercel, Stripe, NOWPayments, Flutterwave, Bybit (user-initiated), and others.
  • Legal category: processor, joint controller, or user-initiated processor.
  • Transfer mechanism per route: EEA-to-EEA, EEA-to-US (DPF + SCCs), EEA-to-Nigeria (SCCs), user-initiated.
  • Change log: every sub-processor addition, removal, or material change, with notification record.
Version
2.2
Last updated
2026-04-22
Review cadence
Re-verified every release. 30-day notice for new sub-processors.
Scope
Processors and sub-processors with access to personal data.
Owner
Clavon Solutions sp. z o.o.
Request current copy

RTR

Responsible Trading Register

An auditable record of how every material product, policy, or infrastructure change tracks against QARI's seven responsible-trading principles. Classifies each change as strengthening, maintaining, or weakening a principle.

What it covers

  • The seven principles: capital preservation, spot-only architecture, transparency, user control, no investment advice, data minimisation, exit discipline.
  • Release-by-release classification: Release 2.1 (BTC.D, NOWPayments, autonomous default), Sprint 10 continuation (L12 patterns, cookies, risk-disclaimer, compliance registers).
  • Principle-level status with evidence. Accepted residual risks.
  • Ethical Trading Advisory Board review trail.
Version
2.2
Last updated
2026-04-22
Review cadence
Every release, at minimum every 6 months.
Scope
All QARI production surfaces.
Owner
Clavon Solutions sp. z o.o.
Request current copy

Why these four

Most compliance programmes publish a privacy policy and stop there. QARI publishes the working documents too. The RoPA is the ground truth of what we process. The DPIA is how we reasoned about the risk. The processor register is the list of every party with access. The responsible-trading register is how we grade ourselves against our own principles, release by release.

The full bodies are available on request to compliance@qari.trade. We reply within five working days. If you need the documents under an NDA for procurement or audit, say so in your email and we will attach the standard template.

Related reading

Responsible-trading principles

Seven principles, three enforcement layers.

Releases, explained

Plain-English walkthrough of what each release does.

Security posture

Perimeter, encryption, pen-test, bug bounty.

Need a signed copy?

Send any procurement request or NDA to compliance@qari.trade and we will route it to the operator within five working days.

Email compliance@qari.trade